Missing Conditional Access Policies

What this means

Your tenant has no Conditional Access policies configured (or all existing policies are disabled). Conditional Access is Microsoft's zero-trust policy engine — it evaluates signals like user location, device state, and risk level to decide whether to allow, block, or require MFA for each sign-in.

Why is it a security risk?

• Without Conditional Access, any valid credential grants access from any location, any device, and any risk level.
• You cannot enforce MFA for risky sign-ins, block legacy authentication, or restrict access to compliant devices.
• Microsoft considers Conditional Access a foundational security control for every Entra ID tenant.

Recommended next steps

1. Go to Microsoft Entra admin center → Protection → Conditional Access.
2. Start with the common policy templates — these cover the most impactful scenarios.
3. At a minimum, create policies to: require MFA for all users, block legacy authentication, and require MFA for admin roles.
4. Use report-only mode first to validate impact before enforcing.